nChronos is designed for monitoring the network traffic in medium and large corporates. It connects to company's core router or switch and monitors all network traffic, emails and chat sessions inbound and outbound. Also, it provides the ability to monitor abnormal traffic and alert upon detection of "Suspicious Conversations". Only when network engineers monitor network activities of the entire network at the packet level are they able to identify abnormal network activities and protect their companies from cyber-crime and cyber-attacks.

nChronos can not only alert an Cyber Attack, but also record all packet data. This ability helps network engineers to "rewind" and "replay" the actual network activity when it occurs. Companies have video cameras to monitor who physically enters their business afterhours, now with nChronos network engineers can monitor and record data activity in a similar manner. The time has come where theft of company assets and intellectual property from data streams and network activity is the greater threat. With a relatively minor investment, nChronos provides an insight and deep packet analysis of all network activity.

nChronos Console

Provides quick access to all distributed deployed nChronos Servers where packets are stored, it serves as the center of the enterprise network management which is capable of visualizing the overall enterprise network activities, drilling down to isolate performance issues and troubleshooting high-priority and critical network issues.

nChronos Server

Performs 7x24 real-time packet capturing and continually store to hard disk for quick packets and statistics retrieval. With flexible and non-intrusive deployment with standard network mirror port or link tap technologies, it provides native packets for the Console to go back in time and complete retrospective network analysis.

Technical Specification

Statistical Reports

nChronos provides both system and user-defined reports. The System Reports include global report, traffic reports, protocol distribution report, application performance and transaction report, alarm reports and top talkers reports. All reports can be configured to provide actual statistics of the traffic and analysis data in specified time period, as well as the comparison to historical statistics, to thereby provide better references for network administrators. Reports can be sent to specified email recipients. Users can schedule hourly, daily, weekly and monthly reports.

Application Performance Analysis

One of the most critical requirements of management software is the ability to monitor and record detailed application activity. nChronos can define custom application monitoring functions as well as transaction monitoring based on the application data. Then the custom application and transactions capability of nChronos enables the network administrator to view the detailed traffic status and statistics of the application or the transactions.

Real-time Network Monitoring

nChronos offers real-time network statistics, including total bytes, total packets, bandwidth utilization, top IP talkers and top application talkers. With the Real-time statistics, network administrators can instantly understand the current pattern of the network. For example, when the network gets slow, network administrators can log on to nChronos right away and see which hosts are the top talkers, and what applications are consuming the most bandwidth.

Retrospectively Analyze Historical Traffic

nChronos can fast retrieve the traffic packets at any time period (real-time or retrospective), and simultaneously drill down for data-mining and full analysis. nChronos helps network users to quickly pinpoint, analyze, and resolve network and application problems, detect the attacks and threats, efficiently and in-depth analyze the network activities. By back-in-time network analysis, nChronos can efficiently solve the network interruption issues.

Benchmark and Visualize Trends of Network Performance

Based on the long-term network traffic capture and analysis data, nChronos visualizes the statistics in trend charts to help IT stuff establish baseline for the entire network, and get hold of the trend of the network operations in long-term running, identify and pinpoint network problems, acquire the evidence for decision-making on network policies, and reinforce the overall technical level for network management as well as the ability to solve network issues.

Efficient Drill-down for Data-mining & Index

nChronos provides efficient data retrieving and drilling down over any time period for hours, days, or weeks with accurate time stamp. It offers complete access to application level traffic flows, network statistics and data links information across all seven OSI layers level. This powerful framework can greatly reduces the time of identifying root-cause and resolving the problem.

Note: To have an analysis performance of 20,000 Mbps, professional capture cards are necessary.

System Requirements for nChronos Server

The following table lists the minimum system requirements for nChronos Server.

Operating system: CentOS release 6.6 or 7.1

CPU: 4-core, 1.8GHz

RAM: 8GB

Hard disk: At least one disk with free space of at least 200GB

Network interface: At least 2 network interfaces

Depending on network traffic and analysis performance required, the requirements may be substantially higher.

Factors that contribute to superior performance include high speed CPU, RAM, and high performance disk storage subsystem, and enough hard disk space is required to store network packets and data that you want to have.

In nChronos 5.2, a new feature, TCP transaction analysis, is provided. TCP transaction analysis allows users to define the transaction by configuring the protocol on the application level. And this would make transaction identification and analysis more accurate.

Troubleshooting network problems can be a very intensive and challenging process. Intermittent network problems are even more difficult to troubleshoot as the problem occurs at random times with a random duration, making it very hard to capture the necessary information, perform troubleshooting, identify and resolve the network problem.

HTTP reconstruction is an advanced network security feature offered by nChronos version 4.3.0 and later. nChronos is a Network Forensic Analysis application that captures packets/data around the clock. With HTTP reconstruction, network security engineers and IT managers can uncover suspicious user web activity and check user web history to examine specific HTTP incidents or HTTP data transferred in/out of the corporate network.

If you use nChronos to monitor traffic on a core switch you will see lots of internal IP addresses, and also the Internet IP addresses. You can find that most of the Internet IP addresses are shown as their domain name, such as www.colasoft.com.

As a network performance analysis solution, nChronos allows users to view historical data just by a drag. Below is a screenshot of the Time Window, you can drag the trend charts back and forth to view the network traffic of any interested time period.

A network link is defined as the traffic source of a monitoring session. Depending on different editions, higher edition enables you to use one nChronos server to monitor mirror traffic from multiple NICs in one link, while basic edition may only support monitor traffic from a single NIC. .

nChronos Console provide quick access to all distributed deployed nChronos Servers where packets are stored, it serves as the center of the enterprise network management which is capable of visualizing the overall enterprise network activities, drilling down to isolate performance issues and troubleshooting high-priority and critical network issues.

After the installation of nChronos, this step by step guide helps you finish all the necessary configurations before nChronos actually start working. Now you have a DVR for Network Data. Simply dial back the time and watch historical traffic of your network from last week as if in "real-time".

nChronos provides a link monitor window which automatically shows top talkers. They are: top segments, top applications, and top internal hosts. With these charts, you can quickly identify the top talkers at a glance. You can also modify the refresh interval for the charts if you like or change the number of Top Talkers displayed.

Network problems never occur when you watching the network. With nChronos you can now simply "rewind and replay" your network traffic. This allows you to isolate and solve the network problem based on the first occurrence. You no longer have to wait for it to fail again to solve the problem.

nChronos is an affordable deep pack recorder and network forensic solution that can help you isolate many network issues in a matter of minutes.Here are the top 5 reasons to buy your company a nChronos...

Enter the serial number, choose Active online and click Next to complete the activation.

How do I activate nChronos Server from nChronos Console?

* Only works for version 4.X.

Start nChronos Console.

On the Server Explorer, click to add the nChronos Server that you want to activate.

hen the Server appears on the Server Explorer.

Double-click the server node, for example, local server.

Then a message box pops up to prompt that the Server is inactivated:

Click Yes, and then follow the Activation Wizard to complete the activation.

What's the difference between Activate online and Activate with license file?

There are two options to activate nChronos Server: Activate online and Activate with license file.

Activating nChronos Server online

To activate nChronos Server online, just enter the serial number and then click Next to complete the activation. This method is very quick and easy, and the activation process will only take a few seconds.

If you have Internet connection, you are recommended to activate nChronos Server online.

Activating nChronos Server with license file

When you don't have Internet connection or failed to activate online, you can choose this method to activate nChronos.

Enter the serial number, choose "Activate with license file", and then click Next. You will get an interface as the figure below:

The license file is generated by the serial number and the machine code, and can be obtained by two ways: via Colasoft Webpage and via Colasoft Support.

Obtaining license file via Colasoft webpage

Follow steps below to obtain license file via Colasoft Webpage:

On the activation interface, click the link in Option 1, and then Colasoft Activation Webpage pops up:

Click the button Save as Bin to save the license file as a .bin file.

On the activation interface, click Browse to import the saved .bin file, and then click Next to complete the activation.

Obtaining license file via Colasoft Support

Follow the steps below to obtain license file via Colasoft Support:

On the activation interface, copy the information of serial number, machine code, as well as product version, and send it to

Colasoft Support will send you the license file via email.

On the activation interface, click Browse to import the license file and then click Next to complete the activation.

Study your network topology and find the perfect place from where you want to capture traffic you need. The core switch (a managed switch) is the perfect choice, which enables you to capture all data on the switch, and a hub or Tap works for data capture as well.

Read System Requirements (both nChronos server and console) to prepare a server and a machine for console.

Want to Know More About nChronos?

nChronos is a Network Performance Analysis Solution. It integrates real-time network monitor with long-term network data storage, drilldown and retrieval. nChronos includes nChronos Server and nChronos Console in client/server architecture. nChronos Server is for traffic capture, analysis, statistics and storage, while nChronos Console is for data presentation, analysis and output by accessing data from nChronos Server.

What's the difference between Capsa and nChronos?

Both Capsa and nChronos are for network analysis and network performance management. Capsa is a portable, real-time network analyzer, while nChronos integrates real-time monitor with long-term network data storage and analysis. nChronos surpasses Capsa with more features and better performance.

What's the difference between HTTP port and TCP port?

HTTP port is for users to access nChronos Server from web browsers to make configurations, while TCP port is for nChronos Consoles to connect to nChronos Server for acquiring data.

Is the communication between nChronos Server and nChronos Console encrypted?

Yes, the connections between nChronos server and console are encrypted by private encryption algorithm, which secures data transmissions and minimizes the length of data.

Which OS is nChronos based?

nChronos Server is based on CentOS from v5.0, and nChronos Console is based on Windows.

Have Problem While Installation

Why there should be at least two network adapters for nChronos Server?

Based on nChronos architecture, nChronos Server should have at least two network adapters, one for capturing traffic and the other for communicating with nChronos Console.

Can nChronos be accessed from web browsers?

Yes, nChronos Server can be accessed from web browsers for configurations.

Can nChronos monitor multiple network adapters simultaneously?

Yes. nChronos can simultaneously monitor the traffic from multiple network adapters as one traffic source and/or as multiple traffic sources. To monitor as one traffic source, set up one network link and the traffic will be analyzed aggregately. To monitor as separate traffic sources, set up a network link for each capture interfaces and the traffic would be analyzed separately.

Do I need to manually start nChronos every time?

No. Once nChronos Server is installed, the related services start automatically when Windows starts. Users can use Colasoft nChronos Service Manager to start, stop and restart related services.

Can nChronos Server be added to multiple nChronos Consoles?

Yes. One nChronos Server can be accessed by multiple nChronos Consoles and one nChronos Console can connect multiple nChronos Servers simultaneously. Users can create multiple accounts for one nChronos Server with different privileges.

Can I install nChronos Server on a virtual machine?

Since nChronos Server requires lots of system resource to capture, analyze, and store large amount of network traffic, it is not recommended to install nChronos Server on a virtual machine.

Why is there a notice saying that you have reached your installation limits when activating nChronos?

According to our license policy, one license can only be activated on one machine or one OS. If you want to reinstall nChronos on a new machine or on the same machine which is reinstalled with a new OS, there will be a notice: You have reached your installation limits. You should completely uninstall nChronos previously installed and then install it on a new machine or new OS, or you can just contact us for help.

Have Problem While Using

I cannot connect to my nChronos Server. What should I do?

First you need to make sure the server is up and running, and then check if you use the same communication port number as specified on the server (by default port # 3,000). Then you need to check your account and password.

I don't see any statistics in the views except "Select a time range in the Time Window."

You need to click-n-drag on the trend chart to select a time slice. When a time span specified, the views will show data among that time period only.

How do I drill down?

To drill down, just double-click the item you are interested in. The drill-down function is available for the Application view, the Physical Address view, the Network Segment view, the IP Address view, and the IP Conversation view.

I finished the configurations of SMTP settings to alert me anomalies, but I never get an email, why?

After configuring SMTP settings, please click Test to check if the settings are correct.

How can I download the packets on nChronos Server to my local host?

In any view, check the items that you want to download the packets of them, right-click and choose Download Packets from the context menu. Then specify a local folder and file name to save the packets, and then click Download button. Note that you are not suggested to check too many items and download packets from a remote server because they may take a large volume of traffic and take a long time.

Yes. nChronos provides real-time alarms. All the alarms can be defined by users according to actual network status. When alarms are triggered, the alarm logs can be sent to specified email addresses.

Does nChronos provide reports?

Yes. nChronos provides some default reports and users can add new reports according to need. Furthermore, users can schedule daily reports, weekly reports, and monthly reports. All reports can be sent to specified email addresses.

Why the Time Window displays with traffic charts, but I cannot download packets?

When trend charts display with traffic, but no packets can be downloaded, please check if the trend charts display with red scales. The red scales indicate that the packets are discarded due to the circulation of storage space.

Yes. nChronos can analyze the traffic down to protocol field level. Click the button ˇ°Analyze Packetsˇ± to launch the Expert Analyzer which is a built-in component, and then you can go to the Packet view to view packet decoding information.

Can I keep the historical data and configurations when upgrading my nChronos?

Yes. When upgraded from nChronos 4.0, nChronos 4.1 can inherit the configurations and the historically captured data.

What should I do if I forget the password for the administrator account?

When forget the administrator password, you can create a new administrator. First open Colasoft nChronos Service Manager, and then on the menu Configure click Create Administrator to create a new administrator. You can go to the User Account page to delete the original administrator.

Why it pops up "Your license has expired" in the case that my license doesn't expire in fact?